CybersecurityNearMe.aiApply for a Grant
MenuClose
Find a Provider
In-Kind Grants
Learn
AboutContact
Apply for a Grantinfo@cybersecuritynearme.ai

For defense contractors

Know where you stand on CMMC before an assessor does

A small defense contractor can get a CMMC gap assessment at no cost by applying for a Cyber Grants Alliance in-kind grant. An approved provider performs the assessment, and you do not pay for it.

Sources: DoD CIO: About CMMC; NIST Small Business Cybersecurity Corner. DoD suspended CMMC Phase II on July 13, 2026; Phase I self-assessments remain required.

Apply for the CMMC grantBook a CMMC gap assessment

Which level

Which CMMC level are you preparing for?

Know the level before you apply. The grant has a version for Level 1 and one for Level 2.

Find your level
The three CMMC levelsLevel 1, Foundational: Federal Contract Information, 15 requirements from FAR 52.204-21, annual self-assessment. Level 2, Advanced: Controlled Unclassified Information, 110 practices from NIST SP 800-171, self-assessment or third-party assessment depending on the contract. Level 3, Expert: the most sensitive programs, more than 110 practices based on NIST SP 800-172, government-led assessment.1LEVEL 1, FOUNDATIONALYou handle FederalContract Information15 requirements from FAR52.204-21. You check your ownwork once a year.2LEVEL 2, ADVANCEDYou handle ControlledUnclassifiedInformation110 practices from NIST SP800-171. Self-assessment or athird-party assessor, dependingon the contract.3LEVEL 3, EXPERTYou work on the mostsensitive programsMore than 110 practices, basedon NIST SP 800-172. Thegovernment runs the assessment.The three CMMC levelsLevel 1, Foundational: Federal Contract Information, 15 requirements from FAR 52.204-21, annual self-assessment. Level 2, Advanced: Controlled Unclassified Information, 110 practices from NIST SP 800-171, self-assessment or third-party assessment depending on the contract. Level 3, Expert: the most sensitive programs, more than 110 practices based on NIST SP 800-172, government-led assessment.1LEVEL 1, FOUNDATIONALYou handle FederalContract Information15 requirements from FAR 52.204-21.You check your own work once a year.2LEVEL 2, ADVANCEDYou handle ControlledUnclassified Information110 practices from NIST SP 800-171.Self-assessment or a third-partyassessor, depending on the contract.3LEVEL 3, EXPERTYou work on the mostsensitive programsMore than 110 practices, based on NISTSP 800-172. The government runs theassessment.

Scope

What does the Level 2 gap assessment grant include?

The grant covers the assessment and the gap list, the first step. Everything beyond it is available separately from the sponsor, Capital Cyber Compliance.

Included

  • Full evaluation of all 110 NIST SP 800-171 controls
  • Technical infrastructure review
  • Policy and procedure assessment
  • Operational practices evaluation
  • Gap identification across all 14 control families
  • Prioritized list of compliance gaps by severity
  • A clear picture of your current compliance posture

Not included

  • Detailed written assessment report
  • C3PAO readiness preparation
  • Remediation roadmap
  • Plan of Action and Milestones (POA&M)

These are available as add-ons through Capital Cyber Compliance after your gap assessment.

Who it is for

Who should apply?

  • Defense Industrial Base contractors

    Companies in the defense supply chain that handle CUI and must maintain NIST SP 800-171 compliance under DFARS 252.204-7012.

  • Small and mid-size businesses

    Organizations that handle Controlled Unclassified Information and lack internal compliance resources.

  • Government contractors

    Businesses pursuing or renewing federal contracts that require demonstrated cybersecurity compliance.

  • Manufacturers

    Manufacturing companies in the supply chain that need to protect sensitive technical data and meet DoD requirements.

How it works

From application to results

  1. Apply online

    Complete the grant application. Cyber Grants Alliance reviews eligibility from your business size, industry and compliance needs.

  2. Grant approval

    Once approved, you are connected with an independent certified assessor who coordinates the timeline with your team.

  3. Full assessment

    Your organization is evaluated against all 110 NIST SP 800-171 controls across infrastructure, policies and practices.

  4. Results and next steps

    You receive your gap identification with prioritized findings, so you know where you stand and what to do next.

Questions

What do contractors ask first?

Can a small defense contractor get a CMMC gap assessment at no cost?

Yes, through a Cyber Grants Alliance in-kind CMMC gap assessment grant. An approved provider performs the assessment at no cost to you. Eligible applicants are DoD prime contractors, subcontractors and companies in the Defense Industrial Base supply chain.

Is a gap assessment the same as a CMMC certification assessment?

No. A gap assessment evaluates your current posture and identifies gaps. A formal CMMC Level 2 assessment is conducted by an authorized C3PAO, or by self-assessment where the contract allows it.

Is CMMC Phase II still happening?

On July 13, 2026 the Department of Defense suspended CMMC Phase II pending a review by the DoD CIO. Phase I self-assessments remain in place, and NIST SP 800-171 is still the standard in defense contracts. Source: DoD CIO, About CMMC.

Why start with a gap assessment?

Your SPRS score and the affirmation your executive signs must match what is actually in place. A gap assessment shows where you stand against all 110 requirements before anyone signs.

Last reviewed:

Ready to know where you stand?

Apply for the in-kind gap assessment grant, or book a gap assessment directly if you would rather not wait for a grant match.

Apply for the CMMC grantBook a CMMC gap assessment

Or email info@cybersecuritynearme.ai